I'm currently pentesing a client (with permission of course) and we are testing their email filtering capabilities. We want to check whether they reject mail coming from open mail relays, but I seem unable to find any. Is there a list somewhere that we can use? The less reputable the better.

  • 2
    I'm voting to close this question as off-topic because it is essentially asking for a list of vulnerable system which can be misused to attack other systems, i.e. send phishing, spam, bomb threads etc. Disclosing such a list here would be irresponsible and also hopefully quickly out of date. Commented Mar 15, 2019 at 5:12
  • Questions of the type, "where can I find X?" are generally off-topic here.
    – schroeder
    Commented Mar 15, 2019 at 9:42
  • The better option is to set up your open relay instead of abusing someone else's misconfigured system.
    – schroeder
    Commented Mar 15, 2019 at 9:42
  • @schroeder: Setting up an own open relay for this purpose is impractical: the mail server doesn't test for open relay by trying to relay thought the originating server, but by querying a DNSBL. An own open relay should be actually abused before getting on such list, making you part of the problem! That's why the misconfiguration should be revealed by directly examining the server configuration. No need to pentest for obvious errors. Commented Mar 15, 2019 at 14:50
  • @EsaJokinen I would also submit my personal open relay to these reputation sites.
    – schroeder
    Commented Mar 15, 2019 at 14:53

1 Answer 1


There are Domain Name System-based Blackhole List (DNSBL) like SORBS, but they all work the other way around, allowing to test reputation for known IP address. There's a good reason for that.

While you may have permission to test your client's systems, but you don't have permission to use 3rd party servers for your penetration testing! The open relay servers are typically in this condition by accident.

You are confusing two different things: technological term open relay and Mailgun’s service, which isn't really open as it needs registration. The latter is not illegal, but for the same reason it's not any good for your penetration testing, as it's not necessarily blocked by a DNSBL even if your client has one or more configured.

Instead, you should be testing if your client's servers works as an open relay or a partly open relay due to misconfiguration. Recommendations regarding inbound spam filtering can be given without testing, based on the mail server configuration.

  • Thanks for your answer. Can you clarify something though? When you say "You don't have permission to use 3rd party servers for your penetration testing!" what exactly do you mean? Aren't open relay servers specifically for forwarding mail? And we're not trying to pentest the servers themselves. One of the services I found was this: mailgun.com/smtp/free-smtp-service/free-open-smtp-relay, and as we're not spamming or phishing using the service I don't think it's against their ToS
    – trallgorm
    Commented Mar 15, 2019 at 14:21
  • I tried to clarify this in my edit. Commented Mar 15, 2019 at 14:43
  • 1
    Yea that makes a lot of sense actually I was pretty confused as to why mailgun was calling itself an open relay but required registration. Is that a mislabeling on their part?
    – trallgorm
    Commented Mar 15, 2019 at 15:33

Not the answer you're looking for? Browse other questions tagged .